Summary
Konqueror crashes if JavaScript code tries to read the source of a child
iframe which is set to an ftp:// URL.
Impact
It is possible for malicious websites to crash Konqueror and possibly
other applications with rely on KJS.
Details
The KDE JavaScript implementation, KJS has been found to crash when it
tries to read the contents of an FTP iframe. This can be demonstrated
by creating a web page with an iframe with a src of
"ftp://localhost/anything", then reading the contents of this iframe
with JavaScript similar to the following. (A working FTP server is not
required).
var contents =
document.getElementById(iframe_name).contentWindow.document.body.innerHTML;
Exploit
Proof of concept code is available at:
http://bindshell.net/advisories/konq355
Vulnerable Versions
This vulnerability has been tested on Gentoo and Debian running KDE 3.5.5.
Reported By
mark_at_bindshell.net
http://bindshell.net/advisories/konq355
Disclosure Timeline
2007-02-03 Vulnerability reported to security_at_kde.org
2007-02-28 KDE team recreate bug and produce preliminary patch for
nodes.cpp
2007-03-01 KDE team produced updated patch for ecma/kjs_html.cpp
2007-03-04 Public advisory released
Patch Information
The latest patch received from the KDE team is available from:
http://bindshell.net/advisories/konq355/konq355-patch.diff
Received on Mar 05 2007
Intro
